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I. INTRODUCTION 

The qualitative connection between secrecy of infor- 
mation and the ability to maintain quantum correlations 
has long been a part of quantum information theory. The 
connection comes about from the observation that a max- 
imally entangled ebit state, shared between two parties 
named Alice and Bob, has no correlations with the "rest 
of the universe" — in this sense, the ebit is monogamous 
[1]. We can represent the global state of the ebit and the 
"rest of the universe" as 
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where Alice and Bob share the ebit <l>^^, and 
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and (7^ is some state of Eve, a third party representing 
the "rest of the universe." Eve's state is indepen- 
dent of Alice and Bob's ebit. The relation to a secret 
key comes about when Alice and Bob perform local mea- 
surements of the ebit in the computational basis. The 
resulting state is 

where $ is the maximally correlated state: 
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In this setting, the cryptographic setting, we consider 
Eve as a potential eavesdropper. She is no longer the 
"rest of the universe," because some party now holds the 

purification of the dephased state ^ 

The body of literature on the privacy /quantum- 
coherence connection has now grown substantially. Some 
of the original exploitations of this connection were the 
various quantum key distribution protocols [11 [3l [4]. 
These protocols establish a shared secret key with the 
help of a noisy quantum channel or noisy entanglement. 
The subsequent proofs [5l [6] for the security of these 
protocols rely on the formal mathematical equivalence 
between entanglement distillation [7 and key distilla- 
tion. Schumacher and Westmoreland explored the con- 
nection with an information-theoretical study [8 — they 
established a simple relation between the capacity of a 
quantum channel for transmitting quantum information 
and its utility for quantum key distribution. Collins 
and Popescu [9 and Gisin et al. [10] initiated the for- 
mal study of the connections between entanglement and 
secret key. Since then, researchers have determined a 
method for mapping an entangled state to a probability 
distribution with secret correlations [11^ and have contin- 
ued to extend existing quantum results [12] to analogous 
results for privacy [T3] . 

The connection has also proven fruitful for quantum 
Shannon theory, where we study the capabilities of a 
large number of independent uses of a noisy quantum 
channel or a large number of copies of a noisy bipartite 
state. The first step in this direction was determining 
the capacity of a quantum channel for transmitting a pri- 
vate message or establishing a shared secret key [HI [15] . 
Devetak further showed how coherently performing each 
step of a private protocol leads to a code that achieves 
the capacity of a quantum channel for transmitting quan- 
tum information [14]. Since these initial insights, we 
have seen how the seemingly different tasks of distilling 
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secret key, distilling entanglement, transmitting private 
information, and transmitting quantum information all 
have connections [16]. Oppenheim et al. have deter- 
mined a merging protocol for private correlations |l7] . 
based on the quantum state merging protocol [18[ [19]. 
Additionally, the secret-key-assisted private capacity of 
a quantum channel [20 is analogous to its entanglement- 
assisted quantum capacity [21, .22^ . 

The connection is only qualitative because the 
Horodeckis and Oppenheim have observed that there ex- 
ist bound entangled states [23]. These bound entangled 
states are entangled, yet have no distillable entanglement 
(one cannot extract ebits from them), but they indeed 
have distillable secret key. The dynamic equivalent of 
this state is an entanglement binding channel [24] [25j [2^ . 
This channel has no ability to transmit quantum informa- 
tion. The loss of the privacy-coherence connection here is 
not necessarily discomforting. In fact, it is more interest- 
ing because it leads to the "superactivation effect" [27] — 
the possibility of combining two zero-capacity channels 
to form a quantum channel with non-zero quantum ca- 
pacity. Additionally, the private analog of this scenario 
exhibits some unexpected behavior |28] . 

In this paper, we continue along the privacy-coherence 
connection and detail the publicly-enhanced private fa- 
ther protocol. This protocol exploits a secret key and 
a large number of independent uses of a noisy quantum 
channel to generate noiseless public communication and 
noiseless private communication. This protocol is the 
"public-private" analog of the classically-enhanced father 
protocol [29], and might lead to further insights into the 
privacy-coherence connection. The publicly-enhanced 
private father protocol combines the coding techniques of 
the suggested protocol in Section 4 of Ref. [30 (originally 
proven for the classical wiretap channel [31 ) with the re- 
cent secret-key-assisted private communication protocol 

m- 

We structure this work as follows. The next section 
establishes the definition of a noiseless public channel, a 
noiseless private channel, noiseless common randomness, 
and a perfect secret key. We then clarify a small point 
with the protocol for private communication [M] |T5] — 
specifically, we address the apparent ability of that pro- 
tocol to transmit public information in addition to pri- 
vate information. Section |IV| describes the publicly- 
enhanced private father protocol and states our main 
theorem (Theorem [T]). This theorem gives the capacity 
region for the publicly-enhanced private father protocol. 
We proceed with the proof of the corresponding converse 
theorem in Section \V\ and the proof of the corresponding 
direct coding theorem in Section [Vlj Section |VII| shows 
that the suggested protocol from Ref. [30] is a child of 
the publicly-enhanced private father protocol. We then 
conclude with some remaining open questions. 



II. DEFINITIONS AND NOTATION 

We first introduce the notion of a noiseless public chan- 
nel, a noiseless private channel, and a noiseless secret 
key as resources. Our communication model includes 
one sender Alice, a receiver Bob, and an eavesdrop- 
per Eve. Alice chooses classical messages k from a set 
[K] = {1, . . . , K}. She encodes these messages as quan- 
tum states {\k) {k\^}f.^^x]- We assume that each party 
is in a local, secret facility that does not leak informa- 
tion to the outside world. For example. Eve cannot gain 
any information about a state that Alice or Bob prepares 
locally. We consider two dynamic resources, public clas- 
sical communicaton and private classical communication, 
and two static resources, common randomness and secret 
key. 

A noiseless public channel idp^^ from Alice to Bob 
implements the following map for k G [K]: 

id^2''--\k){k\^^\k){kf® PK'\K{k'\k)p§, (1) 

k'e[K] 

where Pk'\k {k'\k) is some conditional probability distri- 
bution and pf, is a state on Eve's system. The above 
definition of a noiseless public channel captures the idea 
that Bob receives the classical information perfectly, but 
Eve receives only partial information about Alice's mes- 
sage. Eve has perfect correlation with Alice's message 
if and only if her conditional distribution Pk'\k {k'\k) is 

8k' and her states = \k^) {k'\^ for all k' . We make no 
distinction between a noiseless public channel where Eve 
receives partial information and one where Eve receives 
perfect information because we are only concerned with 
the rate at which Alice can communicate to Bob — we are 
not concerned with the more general scenario of broad- 
cast communication where Eve is an active party in the 
communication protocol [32 . We represent the noiseless 
public channel symbolically as the following resource: 

The resource inequality framework [2T| uses the nota- 
tion [c c] to represent one noiseless bit of classical com- 
munication. We require a symbol different from [c c] 
because that symbol does not distinguish between public 
and private communication. For example, the superdense 
coding protocol [33| actually produces two private clas- 
sical bits, but the notation [c c] does not indicate this 
fact. 

A noiseless private channel is the following map: 

id^T;^:|fc) {k\^^\k) {fc|^®<7^, 

where cr^ is a constant state on Eve's system, indepen- 
dent of what Bob receives. A private channel appears 
as a special case of a public channel where random vari- 
able K' that represents Eve's knowledge is independent 
of random variable K. The definition in ([T]) reduces to 
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that of a private channel if we set the probabiUty dis- 
tribution in ([T]) to Pk'\k(]^')' But we define a private 
channel as the case when K' and K are independent. 
Otherwise, the channel is public. This difference is the 
distinguishing feature of a noiseless private channel. We 
represent the noiseless private channel symbolically as 
the following resource: 

The above definitions of a public classical channel and 
private classical channel are inspired by definitions in 
Refs. [20, 34 . 

Common randomness is the static analog of a noiseless 
public channel [35l |36l [37]. In fact, Alice can actually 
use a public channel to implement common randomness. 
Alice first prepares a local maximally mixed state tt^ 
where 



1 
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She makes an exact copy of the random state locally to 
produce the following state: 



<|) = 

" \K\ 
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(2) 



ke[K] 



She sends the system through the noiseless public 
channel. The resulting state represents common random- 
ness shared between Alice and Bob, about which Eve may 
have partial information: 



\K 



k'e[K] 



A noiseless secret key is the static analog of a noiseless 
private channel. Alice again prepares the state tt^ and 
makes a copy of it to an A' system. She sends the A' 
system through a noiseless private channel, generating 
the following resource: 

ke[K] 

Alice and Bob share perfect common randomness, but 
this time. Eve has no knowledge of this common ran- 
domness. This resource is a secret key. A perfect secret 
key resource has two requirements [38] : 

1. The key should have a uniform distribution. 

2. Eve possesses no correlations with the secret key. 

We denote the resource of a shared secret key as fol- 
lows: 



[cc] 



priv ' 



Note that a noiseless public channel alone cannot im- 
plement a noiseless private channel, and a noiseless pri- 
vate channel alone cannot implement a noiseless public 
channel. This relation is different from the correspond- 
ing relation between a noiseless quantum channel and a 
noiseless classical channel [39] because a noiseless quan- 
tum channel alone can implement a noiseless classical 
channel, but a noiseless classical channel alone cannot 
implement a noiseless quantum channel. 



III. RELATIVE RESOURCE IN PRIVATE 
COMMUNICATION 

We would like to clarify one point with the protocol 
for private communication [HI [15] before proceeding to 
our main theorem. By inspecting the proof of the di- 
rect coding theorem in Ref. [T¥, one might think that 
Alice could actually transmit public information at an 
additional rate of I {X;E). The following sentence from 
Ref. [14 may lead one to arrive at such a conclusion: 

"By construction. Bob can perform a mea- 
surement that correctly identifies the pair 
(/c,m), and hence /c, with probability > 1 — 

But this conclusion is incorrect because the random 
variable M representing the "public" message m must 
have a uniform distribution. This random variable M 
serves the purpose of randomizing Eve's knowledge of the 
private message k [40 . The protocol would not operate 
as intended if random variable M had a distribution other 
than the uniform distribution. The size of the message 
set for the random variable M must be at least 2^^^-^'-^\ 
The rate / (X; E) of randomization further confirms the 
role of the mutual information as the minimum amount of 
noise needed to destroy one's correlations with a random 
variable [41] (see Refs. [42[ |43] for further explorations 
of this idea). It is thus not surprising that the mutual 
information / (X; E) arises in the protocol for private 
communication because Alice would like to destroy Eve's 
correlations with her private message k. 

The resource inequality [21 for the protocol for private 
communication is as follows: 

{U)>I{X-E) [c^c:7r]p„i,+ 

{I{X;B)-I{X;E))[c^c]^^,^, (3) 

where the mutual information quantities are with respect 
to the following classical-quantum state: 

corresponding to the channel input ensemble 
{Px {x) ^CF^ }xeX' The meaning of the resource in- 
equality is that Alice can transmit nI{X]E) bits of 
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public information (with the requirement that Al- 
ice's random variable has a uniform distribution) and 
n {I {X; B) — I {X; E)) bits of private information by 
using a large number n of independent uses of the noisy 
quantum channel A/". The resource [c ^ c : tt]^^^ is not 
an absolute resource, but is rather a relative resource 
[2TJ [44l [45] , meaning that the protocol only works prop- 
erly if Alice's public variable has a uniform distribution, 
or equivalently, is equal to the maximally mixed state 
TT. This public information must be completely random 
because Alice uses it to randomize Eve's knowledge of 
the private message. 

The resource inequality in (3| leads to a simpler way 
of implementing the direct coding theorem of the secret- 
key-assisted private communication protocol [20 . Sup- 
pose that Alice has public information in a random vari- 
able M. If she combines this random variable with a 
secret key, the resulting random variable has a uniform 
distribution because the secret key randomizes the public 
variable. This variable can then serve as the input needed 
to implement the relative resource of public communica- 
tion. Alice can transmit an extra nl (X; E) of private in- 
formation by combining this public communication with 
the secret key resource, essentially implementing a one- 
time pad protocol [46l |47] . We phrase the above argu- 
ment with the theory of resource inequalities: 

{M) + I{X;E) [cc]p,i, 

>IiX;E)[c^c: n]^^^ + I {X; E) [cc]^^,^ + 
(J(X;B)-J(X;£))[c^c]p,i, 

> / (X; E) [c ^ c]p,i, + (J (X; B) - I {X; E)) [c ^ c]^^,^ 
= I{X;B) [c^c]p,i,. 

This resource inequality is equivalent to that obtained in 
Ref. I20j. 



IV. PUBLIC AND PRIVATE TRANSMISSION 
WITH A SECRET KEY 

We begin by defining our publicly-enhanced private fa- 
ther protocol (PEPFP) for a quantum channel A/"^ 
from a sender Alice to a receiver Bob. The channel has an 
extension to an isometry ^be ^ defined on a bipartite 
quantum system BE^ where Bob has access to system B 
and Eve has access to system E. Alice's task is to trans- 
mit, by some large number n uses of the channel AT, one 
of K public messages and one of M private messages to 
Bob. The goal is for Bob to identify the messages with 
high probability and for Eve to receive no information 
about the private message. In addition, Alice and Bob 
have access to a private string (a secret key), picked uni- 
formly at random from the set [5], before the protocol 
begins. 

An {n^R^P^Rs^e) secret-key- assisted private channel 
code consists of six steps: preparation, encryption, chan- 
nel coding, transmission, channel decoding, and decryp- 
tion. We detail each of these steps below. 



Preparation. Alice prepares a public message A: in a 
register K and private message m in a register M. Each 
of these has a uniform distribution: 



k=l 
1 ^ 
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Alice also shares the maximally correlated secret key 
state ^^^^^ with Bob: 

S = l 

The overall state after preparation is 

Encryption. Alice exploits an encryption map 

/ : [M] X [S] ^ [M] . 

The encryption map / computes an encrypted variable 
/(m, s) that depends on the private message m and the 
secret key s. Furthermore, the encryption map / satisfies 
the following conditions: 

1. For all si, 52 G [S] where Si S2' 

/(m,5i) 7^ /(m,S2). 

2. For all mi,m2 G [M] where mi 7^ 7712: 

/(mi, 5) / /(m2,5). 

The encryption map / corresponds physically to a 
CPTP map J^^Sa^p^ xhe state after the encryption 
map is 



^^|/(m,.))(/(m,.)r0|.) (.|^-. 



MS 



Channel Encoding. Alice prepares the codeword 
state cr^J(^^ based on the public message k and the 
encrypted message f{m^s). This encoding corresponds 
physically to some CPTP map g^^^^ . The state af- 
ter the encoding map is 



KMS 

k,m,s 

Transmission. Alice sends the state 



the channel /7^"^^"^' 



kJim,s) through 
, generating the state 



KMS 



k,m,s 
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where 



kj{m,s) 



)■ 



Channel Decoding. Bob receives the above state 
from the channel and would like to decode the messages. 
He exploits a decoding positive-operator- valued measure 
(POVM) that acts on his system . The elements of 
this POVM are 

{^kJ{m,s)}ke[K]J{m,s)e[M]- 

Bob places the measurement results k and / (m, s) in the 
respective registers K and P. The ideal output state 
after Bob's decoding operation is 

E <ffZs)®\s) {sf'®\k){kf®\f{m,s)){f{m,s)f, 



k,m,s 



where it is understood that the normalization factor is 
1/{KMS). 

Decryption. The final step is for Bob to decrypt the 
encrypted message f{m,s). He employs a decryption 
function where 

g:[M]x [S] ^ [M] . 

The decryption function g satisfies the following prop- 
erty: 

\/ s^m g{f{m^s)^s)=m. 

This decryption function allows Bob to recover Alice's 
private message as m = g{f{m^s)^s) based on the en- 
crypted message / (m, s) and the secret key s. Physically, 
this operation corresponds to a CPTP map Q^bP^m ^ 
The state after this decryption map is 



KMS ^ 

k,m,s 



Figure [T] depicts all of the above steps in a general 
publicly-enhanced private father code. 

The conditions for a good publicly-enhanced secret- 
key-assisted private code are that Bob be able to decode 
the public message k and encrypted message p = f (m, s) 
with high probability: 

Vfc,p Tr{AfX;}>l-e. 

It is sufficient to consider the above criterion because Bob 
can determine the private message m with high probabil- 
ity if he can determine the encrypted message p with high 
probability. Also, the following inequality is our security 
criterion: 



V/c, m 




FIG. 1: The above figure depicts all of the steps in a publicly- 
enhanced private father code. Alice performs the encryption 
map on her private variable M and her half Sa of the 
secret key. She then encodes her public variable K and the 
encrypted message with the encoding map 8. She transmits 
the encoded data over a large number of uses of the noisy 
channel J\f. The isometric extension of the noisy quantum 
channel Af is Uj\f, and we give the full purification of the 
channel to Eve. Bob receives the outputs of the channel. He 
performs the decoding map V to recover the public variable 
K and the encrypted message. He combines the encrypted 
message with his half of the secret key and processes these 
two variables with the decryption map Q. He then recovers 
the private variable M. A good publicly-enhanced private 
father code has the property that Bob can perfectly recover 
the public variable K and the private variable M while Eve 
learns nothing about the secret key or the private variable M. 



This criterion ensures that Eve's state is independent of 
the key and the private message m. 

A rate triple (R^P^Rs) is achievable if there exists 
an {n, R — 6^ P — 6, Rs -\- e) publicly-enhanced private 
father code for any e, J > and sufficiently large n. The 
capacity region Cpepfp (AT) is a three-dimensional region 
in the {R^P^Rs) space with all possible achievable rate 
triples {R,P,Rs). 

Theorem 1 The capacity region C{M) of a secret-key- 
assisted quantum channel M for simultaneously transmit- 
ting both public and private classical information is equal 
to the following expression: 



C{N) = U -C(i)(Ar®'), 



(5) 



where the overbar indicates the closure of a set. The 
"one- shot" region C'^^XM) is the set of all R, P, Rs > 0, 
such that 



R<I{X;B),, (6) 

P<Rs + I{Y;B\X)^-I{Y;E\X)^, (7) 

<e. P<I{Y;B\X)„. (8) 

(4) The above entropic quantities are with respect to a "one- 
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shot" quantum state a^^^^ , where 



XYBE 



^p{x)\x){ 



(9) 



id the states p^^^ are of the form 



Y.P^y\x)\y){y?' ®U^-^^{piy), (lo) 



for some density operator p^y and 
metric extension of M . It is sufficient to consider < 
min{|A'|, \B\Y by the method in Ref 1481. 

The proof of the above capacity theorem consists of 
two parts. The first part that we show is the converse 
theorem. The converse theorem shows that the rates in 
the above theorem are optimal — any given coding scheme 
that has asymptoticahy good performance cannot per- 
form any better than the above rates. We prove the 
converse theorem in the next section. The second part 
that we prove is the direct coding theorem. The proof 
of the direct coding theorem gives a coding scheme that 
achieves the Umits given in the above theorem. 



tA'^BE 



IS an iso- 




FIG. 2: The above figure depicts the coding scenario that we 
consider for the converse theorem. It is similar to the protocol 
of Figure [l] with the exception that the goal is for Alice and 
Bob to generate common randomness and a secret key, rather 
than transmitting public and private information respectively. 



Alice prepares a state $ 
generation: 



for common randomness 



V. PROOF OF THE CONVERSE THEOREM 

We outline the proof strategy of the converse before 
delving into its details. Consider that a noiseless public 
channel can generate common randomness and a noise- 
less private channel can generate a secret key. Let K{J\f) 
denote the capacity of a quantum channel M for generat- 
ing common randomness, generating a secret key, while 
consuming a secret key at respective rates {R^P^Rs). 
The capacity region K{Af) contains the capacity region 
C{M) of Theorem [l] {C{JV) C K{JV)) because of the 
aforementioned one-way relation between a noiseless pub- 
lic channel and common randomness and that between a 
noiseless private channel and a secret key. It thus suffices 
to prove the converse for a secret-key-assisted common 
randomness generation and secret key generation proto- 
col. We consider the most general such protocol when 
proving the converse and show that the capacity region 
in (|6][8| bounds the capacity region K{J\f). The result 
of the converse theorem is then that K{J\f) C C{J\f) and 
thus that K{N) = C{JV). 

Proof [Converse] Suppose Alice creates the maximally 
correlated state tt^^a locally, where 



1 ^ 

—MM. i I \ / iM _ I \ / \M\ 

= ^ 2^ |m) (m| |m) (m| ^ 
=1 



(the protocol should be able to transmit the correlations 

m state <P with e-accuracy while keeping them se- 
cret). Alice shares the maximally correlated secret key 

state ^^^^^ with Bob: 



■SaSi 



1 ^ 

4ei 



\s) {sf-<E>\s) {s\ 



k=l 



rKK' 



^MM\ 



^SaSe 



Alice combines her states <l> <|)"^^"^^^, and 

The most general encoding operation that she can per- 
form on her three registers i^^, M^, and Sa is a con- 
ditional quantum encoder ^^a^a^a^a consisting of 
a collection ^g^^^^^A 
element g^^^A 



Ia^a 



}fc of CFTP maps [29 . Each 

of the conditional quantum en- 
coder consists of an encryption with the secret key 
and the mapping to channel codewords. Each element 
g^A^A^A ^Yoduce^ the following state: 



MSbA"" 



pM'^SA- 



■SaSe 



The average density operator over all public messages is 
then as follows: 



\K 



MSbA" 



K 



Alice sends the A'^ system through the noisy channel 
, producing the following state: 



ttA^^^B'^E' 



KMSbB'^E'^ 



k 



Define the systems Y = MSb and X = so that the 
above state is a particular n*^ extension of the state in 
the statement of the public-private secret-key-assisted ca- 
pacity theorem. The above state is the state at time t 
in Figure [2] Bob receives the above state and performs 
a decoding instrument Sb^k^m^ (each element 
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of the instrument consists of a channel de- 



coding and a decryption). The protocol ends at time tf 
(depicted in Figure 2|. Let (^(jj'^^^^b^b^ ^-j^^ state 
at time tf after Bob processes qj^^SbB'^e'^ with the de- 
coding instrument X>^'^^^^^b^b ^ 

Suppose that an {n^R — 5^P — (5, Rs + ^, e) secret-key- 
assisted protocol as given above exists. In particular, the 
following information-theoretic security conditions follow 
from the security criterion in Q: 



I{M;E^\K)^<e, 
IiSB;E^\K)^<e, 



(11) 
(12) 



by the application of the Alicki-Fannes inequality [49 
and evaluating the conditional mutual informations of 
the ideal state a^"" ^tt^^ in These conditions imply 
that Eve learns nothing about the secret correlations in 
system M and Eve learns nothing about the secret key 
Sb (at time t) even if she knows the public variable K. 
We prove that the following bounds apply to the elements 
of the protocol's rate triple {R — P — Rs + S)^ 



R-S < 



P-S< 



n 

I{Y;B^\Xl 



P-5<Rs 



I{Y;B"\X)^-I{Y;E"\X)^ 



Rs 



5> 



I{Y;E"\X)^ 



n 



(13) 
(14) 
(15) 
(16) 



for any e, J > and all sufficiently large n. 

In the ideal case, the ideal private channel acts on sys- 
tem M to produce the maximally correlated and secret 
state TT^^ . So, for our case, the inequality 



< e 



(17) 



holds because the protocol is e-good for private commu- 
nication. The state is some constant state on Eve's 
system. 



The lower bound in (16) is the most straightforward 



to prove. Consider the following chain of inequalities: 
n {Rs + 5) + 2e 

> I (M; E"\K)^ + 1 {Sb; E"\K)^ + H {Sb\K)^ 
= H {M\K)^ + H {E''\K) - H {ME''\K)^ + 
I{Sb;E^\K)^ + H{Sb\K)^ 

> H {M\SbK)^ + H (E^'ISbK) - H {ME''\K)^ + 
I{Sb;E"\K)^+H{Sb\K)^ 

> H {M\SbK)^ + H (E'^ISbK) - H {ME'^SbIK)^ - 
I{Sb;E^\K)^ + H{Sb\K)^ 

= I{M;E^\SbK)^ + I{Sb;E^\K)^ 
= I{MSb;E^\K)^ 
= I{Y;E-\X)^ 



The first inequality follows by combining the equality 
n{Rs+6] = H{Sb) = H{Sb\K) and the security cri- 
teria in ( iTp^ ). The first equality follows from the defi- 
nition of mutual information. The second inequality fol- 
lows because H{M)^ = H{M\SbK)^ {M, Sb, and K 
are independent) and conditioning does not increase en- 
tropy H{E'^\K) > H{E'^\SbK). The third inequality 
follows because the addition of a classical system can in- 
crease entropy H{ME''\K)^ < H {ME''Sb\K)^. The 
second equality follows from the definition of conditional 
mutual information. The third equality follows from the 
chain rule of mutual information, and the last equality 
follows from the definitions Y = MSb and X = K. 



H{SB)+n6' 

H{SB\K) + H{B"K\SBh- 
H{SB\K) + nS' 

H{B"K\Sb)^- 
n5' 

H{B"K)^ - H {MB'^SbK) 
n5' 



We next prove the upper bound in ( 14 ) on the private 
communication rate: 

n{P - 5) 
= H{M) 

= I{M;M'b)^,+H{M\M's) 
< I{M; M'bK)^, + n5' 
<I{M;B"SBK)^+n5' 
= I{M;B"K\SB)o. + n5' 

= H{M\SB) + H{B"K\SBh- 
H{MB''SbK) 
= H{MSb\K) 
H{MB"SbK) 
= H{MSb\K) 
H{MB''SbK) 
<H{MSb\K) 
H{K)-H{K) 
= I{MSB;B'-\K)^+n5' 
= I{Y;B"\X)^+n5' 

The first equality follows by evaluating the entropy for 

the state ¥^ and noting that H (M) = H {M\K). The 
second equality follows by standard entropic relations. 
The first inequality follows from ( p!7[ ), Fano's inequality 
[54 , and conditioning does not increase entropy. The 
second inequality is from quantum data processing. The 
third equality follows from the chain rule for mutual in- 
formation and I{M;Sb) = because M and Sb are 
independent. The fourth equality follows by expand- 
ing the conditional mutual information. The fifth and 
sixth equalities follow from standard entropic relations. 
The last inequality follows because conditioning does 
not increase entropy H{B''K\Sb)u < H{B''K)^. The 
fifth equality follows by the definition of mutual infor- 
mation, and the last equality follows from the definitions 
Y = MSb, X = i^, and (5' = ^ + eP. 

The second bound in ([T5| on the private communica- 
tion rate follows from adding the bound in (14) to the 
bound in (16). 



We can use a proof by contradiction to get the bound 
on the public rate R. Suppose that we have secret key 
available at some rate > I{X] E^)^/n. Then one could 



8 



combine the public communication at rate R with the 
extra secret key in a one-time pad protocol in order to 
generate private communication at a rate R -\- P. The 
resulting protocol consumes secret key at a rate greater 
than / (FX; because 



I{Y;E^\X)^ , I{X;E- 



I{YX-E'') 



The state a; is of the form given by the secret-key-assisted 
capacity theorem [20]. The total amount of private 
communication that a secret-key-assisted protocol can 
generate cannot be any larger than I {Y X] B^) jn [20]. 
The chain rule also applies to the mutual information 
I{YX;B'') In: 

I{Y;B-\X)^ , nX;B-)^ I{YX;B-) 



If the public rate R were to exceed / (X; B^)^ /n, then 
this public rate would contradict the optimality of the 
secret-key-assisted protocol from Ref. [20 . Thus, the 
public rate R must obey the bound in (13). □ 



VI. 



PROOF OF THE DIRECT CODING 
THEOREM 



The direct coding theorem is the proof of the follow- 
ing publicly- enhanced private father protocol resource in- 
equality (See Refs. [211 122 for the theory of resource in- 
equalities): 

{Af)+I{Y;E\X)Jcc]^^,^> 

I {Y- B\X)^ [c ^ c]p,,, + 1 {X- B)^ [c ^ c]p„, . (18) 

The resource inequality has an interpretation as the fol- 
lowing statement. For any e, J > and sufficiently large 
n, there exists a protocol that consumes nI{Y]E\X)^ 
bits of secret key and n independent uses of the noisy 
quantum channel M to generate nl (F; B\X)^ bits of pri- 
vate communication and nl {X ; B) ^ bits of public com- 
munication with e probability of error. In addition, Eve's 
state is e-close to a state that is independent of the pri- 
vate message and the secret key. The entropic quantities 
are with respect to the state a^^^^ in 

The proof of the direct coding theorem proceeds sim- 
ilarly to the proof of the direct coding theorem for the 
classically-enhanced father protocol from Ref. \29 . There 
are some subtle differences between the two proofs, and 
we highlight only the parts of the proof that are different 
from the proof of the classically-enhanced father proto- 
col. The proof begins by showing how to construct a 
random private father code^ similar to the notion of a 
random father code ^ or a random quantum code [M] . 
We introduce the channel input density operator for a 
random private father code and show that it is possi- 
ble to make it close to a tensor-product state. We then 



show how to associate a classical string to a random pri- 
vate father code by exploiting the "code pasting" tech- 
nique from Ref. [30] . The proof proceeds by applying the 
HSW theorem [50', "ST to show that Bob can decode the 
public information first. Based on the public informa- 
tion. Bob decodes the private information. The details 
of the proof involve showing how the random publicly- 
enhanced private father code has low probability of error 
for decoding the public information and the private in- 
formation. Finally, we employ the standard techniques 
of derandomization and expurgation to show that there 
exists a particular publicly-enhanced private father code 
that achieves the rates given in Theorem [l] 

A. Random Private Coding 

We ffist recall the secret-key-assisted private communi- 
cation capacity theorem (also known as the private father 
capacity theorem) [20 . 

Theorem 2 The secret-key- assisted private channel ca- 
pacity region CsKP^-^f) is given by 



(19) 



where the overbar indicates the closure of a set, and 
^SKp(-^) of Rs >0, P>0 such that 

P<I{Y;B),-I{Y;E),^Rs (20) 

P<I{Y;B),, (21) 

where Rs is the secret key consumption rate and p is a 
state of the form 



P 



YBE 



Y.P^y)\y){y\^ ®uti-'^'^(p^'\ (22) 



A'^BE 



is an isomet- 



for some ensemble {p{y)-,py } and Uj^ 
ric extension of M . 

The channel input density operator (C) for a pri- 
vate father code C = {Pm'^}me[M] is a uniform mixture 
of all the private codewords p^"^ in code C: 



4'" 



(C) 



M ^ 



M 



We cannot say much about the channel input density 
operator p^"" (C) for a particular private father code C. 
But we can say something about the expected channel 
input density operator of a random private father code C 
(where C itself becomes a random variable). 

Definition 1 A random private father code is an ensem- 
ble {pc^C} of codes where each code C occurs with prob- 
ability pc- The expected channel input density operator 
'p^ is as follows: 



(23) 
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A random private father code is "p-like^^ if the expected 
channel input density operator is close to a tensor power 
of some state p: 



P 



< e. 



(24) 



We now state a version of the direct coding theorem 
that apphes to random private father codes. The proof 
shows that we can produce a random secret-key-assisted 
private code with an expected channel input density op- 
erator close to a tensor power state. 

Proposition 3 For any e^S > and all sufficiently large 
n, there exists a random -like secret-key- assisted pri- 
vate code for a channel such that 



(25) 



where p^ is defined in (23). The random private code 
has private communication rate I{Y] B)p — 5 and secret 
key consumption rate /(F; E)p + 5. The entropic quan- 
tities are with respect to the state in (2^ and the state 



P 



A' 



T.yP{y) py- 



The proof of Proposition [3] is an extension of the devel- 
opment in Appendix D of Ref. and the development 
in Ref. [20]. 

Proof Consider the density operator p^ where 



The n"^ extension of the above state as a tensor power 
state is as follows: 



where 



py- = pi 



'pi 



'Pv' ■ 



We define the pruned distribution p''^ as follows: 



p"" (x^) 







else, 



where Tj"^ denotes the J-typical set of sequences with 
length n. Let p^ denote the following "pruned state" : 

E v'-{y-)pS. (26) 

For any e > and sufficiently large n, the state p^ ^ is 
close to by the gentle measurement lemma ^2] and 
because the probability for sequences outside the typical 
set is small: 



4'^ 



< 2e. 



For any density operator p^', it is possible to con- 
struct a secret-key-assisted private code that achieves the 
private communication rate and secret key consumption 
rate in Proposition [3j 

Let [M] denote a set of size 2^[^'^^'^)~^^] for some 
constant c and let Um denote 2^^^^''^^~^^^ random vari- 
ables that we choose according to the pruned distribution 
pfnf^yny rpj^^ realizations Um of the random variables Um 
are sequences in and are the basis for constructing 
a secret-key-assisted private code C with the following 
codeword ensemble: 

We then perform a decoding positive operator- valued 
measure (POVM) with elements {^m}me[M] and decryp- 
tion map resulting in failure with probability 4e + 20v^ 
by the arguments in Ref. [2Qj . 

Suppose that we choose a particular secret-key-assisted 
private code C according to the above prescription. Its 
code density operator is 



4'^ 



(C) 



1 



M ^ 



M 

^ Pul 



Suppose we now consider the secret-key-assisted pri- 
vate code chosen according to the above prescription as a 
random code C (where C is now a random variable). Let 
^lA (^Q^ channel input density operator for the 

random code before expurgation and p^ (C) its channel 
input density operator after expurgation: 



m=l 



where the primed rates are the rates before expurgation 
and the unprimed rates are those after expurgation (they 
are slightly different but identical for large n). Let 'p'^ 
and denote the expectation of the above channel 
input density operators: 



-A'^ — 



Choosing our code in the particular way that we did 
leads to an interesting consequence. The expectation of 
the density operator corresponding to Alice's codeword 

p£ ^ 



is equal to the pruned state in (|26|): 



yn 
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because we choose the codewords PyT randomly accord- 
ing to the pruned distribution p'^{y^). Then the ex- 
pected channel input density operator p'^ is as follows: 



^ M' 



m—1 



(27) 
(28) 
(29) 



Then we know that the following inequality holds for 



and the tensor power state p"* 

< 2e 



(30) 



by the typical subspace theorem and the gentle measure- 
ment lemma. The expurgation of any secret-key-assisted 
private code C has a minimal effect on the resulting chan- 
nel input density operator [30] : 



(C) 



4'" 



The above inequality implies that the following one holds 
for the expected channel input density operators 'p'^ 
and 



(31) 



because the trace distance is convex. The following in- 
equality holds 



< 2e + 4^ 



(32) 



by applying the triangle inequality to (30) and (|3l[). 



Therefore, the random secret-key- assisted private code 
is p-like. □ 



B. Associating a Random Private Code with a 
Classical String 

Suppose that we have an ensemble {p{x)^ px}xex 
of quantum states. The density operator px arises 
as the expected density operator of another ensemble 
{p{y\^) 1 Px,y}' Let x'^ = xi---Xn dcuotc a classical 
string generated by the density p{x) where each symbol 
Xi ^ X. Then there is a density operator correspond- 
ing to the string x'^ where 



i=l 

Suppose that we label a random private code by the 
string x'^ and let 'p^n denote its expected channel input 
density operator. 



Definition 2 A random private code is {pxr^)-like if the 
expected channel input density operator p^n is close to 
the state px^ : 



pS^ 



Px"^' 



< e. 



Proposition 4 Suppose we have an ensemble as above. 
Consider a quantum channel with its isomet- 

ric extension U^^^^ . Then there exists a random 
{pxri)-like secret-key- assisted private code for the channel 
j^A -^B (5 > 0; for all sufficiently large n, and 

for any classical string x^ in the typical set 154 /• Its 
private communication rate is I{Y;B\X) — c'5, and its 
secret key consumption rate is I{Y; E\X) — c"5 for some 
constants d ^c" where the entropic quantities are with re- 
spect to the state in The state px is the restriction 
of the following state 



Px 



to the A' system. 



p{y\x)\y){y\' ® p^y 



Proof [Proposition [4] The proof of this theorem pro- 
ceeds exactly as the proof of Proposition 3 in Ref. [29] 
and the proof of Proposition 5 in Ref. |30] . □ 



C. Publicly-enhanced secret-key-assisted private 
code 



Proposition 5 (HSW Coding Theorem [SOllST] ) 

Consider an input ensemble {p{x)^p^ } that gives rise 
to a classical- quantum state , where 



xex 



p{x)\x){x\''®M^'-^{pi'). 



Let R = I{X; B)cr — c'5 for any 5 > {) and for some 
constant d . Then for all e > and for all sufficiently 
large n, there exists a classical encoding map 

and a decoding POVM 

that allows Bob to decode any classical message k G [2"'^] 
with high probability: 

Tr{rrAf}>l-e. 

The density operators r^"" are the channel outputs 



B"^ xrA'^'^B'' ( A"^ \ 

yph{k)) 



(33) 



and the channel input states p^n^ are a tensor product of 
states in the ensemble: 



4'" 



Px[- 
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We are now in a position to prove the direct coding part 
of the pubhcly-enhanced private father capacity theorem. 
The proof is similar to that in Ref. [29l [30] . 
Proof [Direct Coding Theorem] Define the pubhc 
message set [2^^], the classical encoding map /i, the 
channel output states r^'^, and the decoding POVM 
{A^'^}/.^2^^ cis in Proposition^ We label each public 
message k G [2^^] where R = /(X; B) - c'S. 

Invoking Proposition 4 there exists a random 
like private code Ck wit n probability density pcfc because 
each input to the channel p^j^^ is a tensor product of 

an ensemble {p{x)^p^ }. The random private code Ck 
has encryption-decryption pair {fck^9Ck) encoding- 
decoding pair (Sck^'^Ck) each of its realizations. 
We label the combined operations simply as the pair 
^^^mSa^a'- ^^B-Su^My transmits n[I {Y B\X) ^ c' 5] 
private bits, provided Alice and Bob share at least 
n[I{Y] E\X) + c"8] secret key bits. 

Let C denote the random publicly- enhanced secret-key- 
assisted private code that is the collection of random pri- 
vate codes {Ck}ke[2^^]- We first prove that the expec- 
tation of the error probability for public message k is 
small. The expectation is with respect to the random 
private code Ck- Let r^^ denote the channel output den- 
sity operator corresponding to the private code Ck'- 



MSa- 



■SaSl 



))}. 



Let denote the expected channel output density op- 
erator of the random father code Ck'- 



Ck 



TDTl 

PCk^Ck 



The following inequality holds 



Ph(k) 



■ Ph{k) 



< me 



because the random private code Ck is (p^^^^-like. Then 

the expected channel output density operator rf^ is close 
to the tensor product state rj^ in (33): 



rf 



rf 



< \X\ 



(34) 



because the trace distance is monotone under the quan- 
tum operation AT^'"^^" . It then follows that the POVM 
element A^"" has a high probability of detecting the ex- 
pected channel output density operator : 



Tr{Af>r}>Tr{AfVr} 



rf 



> 1 



\X\e. 



(35) 



The first inequality follows from the following lemma that 
holds for any two quantum states p and a and a positive 
operator IT where < H < /: 



Tr {Up} > Tr {Ua} 



\\p-^\ 



1 • 



The second inequality follows from Proposition |5] and 
(34). Let Pe,pub(C/c) denote the public message error 
probability for each public message k of the publicly- 
enhanced father code C: 

Pe,^uh{Ck) = I - MK' = k \ K = k}. 



Then by the above definition, and (35), it holds that the 
expectation of the error probability Pe,pub(^/c) foi" public 
message k with respect to the random private code Ck is 
low: 



Ec.{Pe,pub(Cfc)} = l-Tr{A^ } 
<{l + \X\)e. 



(36) 
(37) 



We now show that the private error is small. Input the 
state Tr^^^^^^"" to the encoder f^^^^^", followed by 
. The resulting state is an extension 



the channel AT 



■A'^'^B'^' 



SbB" 



MSa^A"" 



Let ^k^^ denote the expectation of Q^^^ with respect 



to the random code Ck' 

^SbB 



It follows that flj^^ is an extension of 



lowing inequality follows from (35): 



^SbB 



Tr{l]r A. }>1-(1 + |A'|)6. 



The fol- 



(38) 



The above inequality is then sufficient for us to apply a 
modified version of the gentle measurement lemma (See 
Appendix C of Ref. ^29^) so that the following inequality 
holds 



} 



< V8(l + |A'|)e. 

We define a decoding instrument 
random publicly-enhanced private father code C as fol- 
lows [291 EH: 



(39) 



for the 



B'^Sb^KM 



where Sb^m ^j^^ decoder for the private father 
code Ck and each map V 



B'^Se 



is trace-reducing. The induced quantum operation cor- 
responding to this instrument is as follows: 
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Monotonicity of the trace distance gives an inequality for 
the trace-reducing maps of the quantum decoding instru- 
ment: 



V. 



B"Sb^M 



V: 



< ^/8{l + \X\)€. 
The following inequality also holds 



(40) 



E 
E 



B'^Se 



Af; 



Af; 



EcJE^{Ar^cr"}| 

} 



= l-Tr{Arf^ 
<(l + |A'|)e. 



(41) 



The first inequality follows by definitions and the triangle 
inequality. The first equality follows because the trace 
distance is invariant under isometry. The second equality 



follows because the operator ^Ck^ positive. The 
third equality follows from some algebra, and the second 
inequality follows from ( 35 ) . The private communication 
for all public messages k and codes Ck is good 



because each code Ck in the random private father code 
is good for private communication. It then follows that 



Ec.{| 



(nlf")-n'^l}<e. (42) 



Application of the triangle inequality to (|42[), (41), and 



( |4Q| ) gives the following bound on the expected private 
error probability: 



Ec, {Pe,priv {Ck)}<e 



(43) 



where 



= (1 + lA'De + y^S(rTW\)~^ + 2^^, 



and where we define the private error Pe,priv {Ck) of the 
code Ck as follows: 



Pe,priv (^/c) — 



V. 



Sr^M 



M 



The above random publicly-enhanced secret-key- 
assisted private code relies on Alice and Bob having ac- 
cess to a source of common randomness. We now show 
that they can eliminate the need for common randomness 
and select a good publicly-enhanced secret-key-assisted 
private code C that has a low public error Pe,pub(C/c) and 
low private error Pe,priv(^^fc) for all public messages in a 
large subset of [2^^]. By the bounds in (36) and (43), the 



following bound holds for the expectation of the averaged 
summed error probabilities: 



^ ^Pe,pub(Cfc) +Pe,priv(Cfc) I < + (1 + \X\)e. 



If the above bound holds for the expectation over all 
random codes, it follows that there exists a particular 
publicly-enhanced private father code C = {Ck}ke[2^^] 
with the following bound on its averaged summed error 
probabilities: 

^ ^Pe,pub(Cfc) +Pe,priv(Cfc) < + (1 + \X\)e. 

k 

We fix the code C and expurgate the worst half of the pri- 
vate father codes — those private father codes with public 
messages k that have the highest value of Pe,puh{Ck) + 
Pe,priv(Cfe). This derandomization and expurgation yields 
a publicly-enhanced private father code that has each 
public error Pe,puh{Ck) and each private error Pe,priv{Ck) 
upper bounded by 2 (e' + (1 + |A'|)e) for the remaining 
public messages k. This expurgation decreases the pub- 
lic rate by a negligible factor of ^. □ 



VII. CHILD PROTOCOLS 



Two simple protocols for the public-private setting are 
secret key distribution and the one-time pad [46l[47]. Se- 
cret key distribution is a protocol where Alice creates 

the state ^ locally and sends the system A' through 
a noiseless private channel. The protocol creates a secret 
key and corresponds to the following resource inequality: 

The one-time pad protocol exploits a secret key and a 
noiseless public channel to create a noiseless private chan- 
nel. It admits the following resource inequality: 



pub 



We now consider some protocols that are child pro- 
tocols of the publicly-enhanced private father protocol. 
Consider the resource inequality in (18). We can com- 



bine the protocol with secret key distribution, and we 
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recover the protocol suggested in Section 4 of Ref. 



VIII. CONCLUSION 



{M) + I{Y;E\X)^ [cc]p,i, 

> / (F; B\X)^ [c ^ c]p,i, + / {X- B)^ [c ^ c]p„, . 

> (/ {Y- B\X)^ - I {¥; E\X)^) [c ^ c]^^,^ + 
I {Y; E\X)^ [c ^ c]p,i, + / (X; B)^ [c ^ c]p„, 

> (/ (Y; B\X)^ - I {Y; E\X)^) [c ^ c]^^.^ + 
I{Y;E\X)^ [cc]p^^^ + 7(X;B)Jc^c]p„, 

By cancellation of the secret key term, we are left with 
the following resource inequality: 



(M) + o [cc]p,i, > (/ (F; B\X)^ - I {Y; E\X)^) [c ^ c] 



priv 



I{X;B)^ 



c] 



pub ■ 



where c>[cc]p^-^ represents a sublinear amount of secret 
key consumption. 

We can combine the publicly-enhanced private father 
protocol with the one-time pad: 



{M)+I{Y;E\X)Jcc]^^,^ 
>I(Y;B\X)Jc^c]^^,^- 
+ HX-B)^ [cc]p,,, 
>I(Y-B\X)^c^c]^^,^- 
= I{XY;B)^ [c^ci 



-I{X;B)Jccl^,^ 
J(X;B)Jc^c]p„, 

■I{X;B)Jc^cl 



(44) 



Jpriv 



(45) 



This protocol is one for secret-key-assisted transmission 
of private information. It is not an efficient protocol be- 
cause the optimal secret-key-assisted protocol [20 imple- 
ments the following resource inequality: 

(Af) + I {XY; E)^ [cc]p,,, > I {XY; B)^ [c ^ c]^^,^ 

For a channel with non-zero private capacity so that 
I{X;B)^ - I{X;E)^ > 0, the protocol in (|45| is not 
efficient because it uses more secret key than necessary. 
This inefficiency is similar to the inefficiency that we 
found for combining the classically-enhanced father pro- 
tocol with teleportation (See Section VII of Ref. [29]). It 
is not surprising that this inefficiency occurs because the 
publicly-enhanced private father protocol is the public- 
private analog of the classically-enhanced father protocol 
and the one-time pad protocol is the public-private ana- 
log of the teleportation protocol [9^. 



We have introduced an optimal protocol, the publicly- 
enhanced private father protocol, that exploits a secret 
key and a large number of independent uses of a noisy 
quantum to transmit public and private information. 
Several protocols in the literature are now special cases 
of this protocol. 

A few open questions remain. It remains to determine 
the capacity regions of a multiple-access quantum chan- 
nel [48l [56] and a broadcast channel [32 for transmitting 
public and private information while consuming a secret 
key. One might also consider the five-dimensional re- 
gion corresponding to the scenario where Alice and Bob 
consume secret key, entanglement, and a noisy quan- 
tum channel to produce quantum communication, public 
classical communication, and private classical communi- 
cation. This scenario might give more insight into the 
privacy /coherence correspondence. It remains open to 
determine the full triple trade-off for the use of a quan- 
tum channel in connection with public communication, 
private communication, and secret. We have made initial 
progress on this problem by exploiting techniques devel- 
oped in Ref. [39]. Before completing this work, we need 
to determine a publicly-assisted private mother proto- 
col, the analog of the classically-assisted mother protocol 
in Refs. [2ll [39^. This protocol should then allow us to 
determine the full triple trade-off for both the dynamic 
setting and the static setting. 
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